Bookend for the session that root-caused ovn-central's cert failure (isolated
metal-internal plane -> empty CN), proved the /etc/hosts fix live, and wired it
via dc-node-etchosts.sh + phase-01 Step 1.2b. Stage 5 remains OPEN.

- docs/session-ledger.md: bounded 2026-08-04 summary; oldest block (07-31 node
  carve) rotated to docs/archive/session-ledger-rotated-20260804.md; 295 lines.
- docs/security-ledger.md: SEC-033 (tls-certificates relation databag exposes
  vault's global-client private key to any juju model reader; interface-level).
- docs/audit/queued-findings-20260804-ovn-cert-fix.txt: close sweep, 4 FIRST
  SURFACE (SEC-033-now-filed, live-model test drift, rack repo-stage prereq,
  juju-routing research note).
- docs/CURRENT-STATE.md: SESSION CLOSE 2026-08-04 pointer; NEXT = step 3 redeploy.

Gauntlet ALL GREEN (99), repo-lint 0 fail. voffice1 synced to HEAD.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf